# -*- coding: utf-8 -*-

import frida
import sys

# HOOK导出函数
"""jscode = 
Java.perform(function () {
    // 0x75377184  Java_com_qianyu_demo_MainActivity_getTest
    // 0x75377270  Java_com_qianyu_demo_MainActivity_resultInt13
    var nativePointer = Module.findExportByName("libdemo.so", "_Z18registerNativeMethP7_JNIEnv");

    send("native: " + nativePointer);

    Interceptor.attach(nativePointer, {
        onEnter: function(args){
            send(args[0]);
            send(args[1]);
            send(args[2].toInt32());
            send(args[3].toInt32());
            send(args[4].toInt32());
        },
        onLeave: function(retval){
            send(retval.toInt32());
        }
    });
});
"""

# HOOK函数参数返回值修改
"""jscode = 
Java.perform(function () {
    var nativePointer = Module.findExportByName("libdemo.so", "Java_com_qianyu_demo_MainActivity_resultInt");

    send("native: " + nativePointer);

    Interceptor.attach(nativePointer, {
        onEnter: function(args){
            send(args[0]);
            send(args[1]);
            send(args[2].toInt32());
            send(args[3].toInt32());

            args[3]=ptr(4000); 
            send(args[3].toInt32());

            send(args[4].toInt32());
        },
        onLeave: function(retval){
            send(retval.toInt32());

            retval.replace(true);

            send(retval.toInt32());
        }
    });
});
"""

# HOOK枚举导入导出
"""jscode = 
Java.perform(function () {
    /*var imports = Module.enumerateImportsSync("libdemo.so");
    for(var i=0;i<imports.length;i++){
        if(imports[i].name == 'kill'){
            send("name:"+imports[i].name+"  address:"+imports[i].address);
        }
    }*/

    send("===========================================")

    var exports = Module.enumerateExportsSync("libdemo.so");
    for(var i=0;i<exports.length;i++){
        if(exports[i].name.indexOf('_resultInt') != -1){
            send("name:"+exports[i].name+"  address:"+exports[i].address);
        }
    }
});
"""

# HOOK动态获取地址
"""jscode = 
Java.perform(function () {
    send("start");

    Process.enumerateModules({
        onMatch: function(exp){
            if(exp.name == 'libdemo.so'){
                send('enumerateModules find');
                send(exp.name + " | " + exp.base + " | " + exp.size + " | " + exp.path);
                //send(exp);
                return 'stop';
            }
        },
        onComplete: function(){
            send('enumerateModules stop');
        }
    });

    var soAddr = Module.findBaseAddress("libdemo.so");
    send(soAddr);
});
"""

# HOOK未导出函数
"""jscode = 
Java.perform(function () {
    var baseAddr = Module.findBaseAddress("libdemo.so");
    send("baseAddr:"+baseAddr);

    //ARM  thumb+1
    Interceptor.attach(baseAddr.add(0x1270),{ 
        onEnter: function(args) {
            send(args[0]);
            send(args[1]);
            send(args[2]);
            send(args[3]);
            send(args[4]);
        },
        onLeave: function(retval){
            send(retval);
        }
    });
});
"""

# HOOK修改内存数据
jscode = """
Java.perform(function () {
    send("start");

    var baseAddr = Module.findBaseAddress("libhelloworld.so");
   
    send("baseAddr:"+baseAddr);

    var resultPtr=null;

    //ARM  thumb+1
    Interceptor.attach(baseAddr.add(0xF6C),{ 
        onEnter: function(args) {
            send(args[0]);
            send(args[1]);
            //send(args[2]);
            //send(args[3]);
            resultPtr=args[1];

            //Memory.readCString(args[2]);
            //Memory.readUtf16String(args[3]);
        },
        onLeave: function(retval){
            send("==============");
            send(retval)
            //retval.replace(true);
            
            var env = Java.vm.getEnv();
            var jstring = env.newStringUtf('yijin');
            retval.replace(ptr(jstring));
            
            var buffer = Memory.readByteArray(resultPtr, 16);

           console.log(hexdump(buffer, {
                offset: 0,
                length: 16,
                header: true,
                ansi: false
            }));

            //Memory.writeByteArray(resultPtr, stringToBytes('qian'));

            buffer = Memory.readByteArray(resultPtr, 16);

            console.log(hexdump(buffer, {
                offset: 0,
                length: 16,
                header: true,
                ansi: false
            }));
        }
    });
});
"""

def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.qianyu.helloworld')
script = process.create_script(jscode)
script.on("message", message)
script.load()
sys.stdin.read()

